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Abstract. The aim of this paper is to justify the common cryptographic 
practice of selecting elliptic curves using their order as the primary cri- 
terion. We can formalize this issue by asking whether the discrete log 
problem (dlog) has the same difficulty for all curves over a given fi- 
nite field with the same order. We prove that this is essentially true 
by showing polynomial time random reducibility of DLOG among such 
curves, assuming the Generalized Riemann Hypothesis (GRH). We do so 
by constructing certain expander graphs, similar to Ramanujan graphs, 
with elliptic curves as nodes and low degree isogenics as edges. The re- 
sult is obtained from the rapid mixing of random walks on this graph. 
Our proof works only for curves with (nearly) the same endomorphism 
rings. Without this technical restriction such a DLOG equivalence might 
be false; however, in practice the restriction may be moot, because all 
known polynomial time techniques for constructing equal order curves 
produce only curves with nearly equal endomorphism rings. 

Keywords: random reducibility, discrete log, elliptic curves, isogenies, 
modular forms, i-functions, generalized Riemann hypothesis, Ramanu- 
jan graphs, expanders, rapid mixing. 



1 Introduction 



Public key cryptosystems based on the eUiptic curve discrete loga- 
rithm (dlog) problem ^22„34j have received considerable attention 
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because they are currently the most widely used systems whose un- 
derlying mathematical problem has yet to admit subexponential at- 
tacks (see jSHSHIini)- Hence it is important to formally understand 
how the choice of elliptic curve affects the difficulty of the result- 
ing DLOG problem. This turns out to be more intricate than the 
corresponding problem of DLOG over finite fields and their selection. 

To motivate the questions in this paper, we begin with two ob- 
servations. First, we note that one typically picks an elliptic curve at 
random, and examines its group order (e.g. to check if it is smooth) 
to decide whether to keep it, or discard it and pick another one. It is 
therefore a natural question whether or not DLOG is of the same dif- 
ficulty on curves over the same field with the same number of points. 
Indeed, it is a theorem of Tate that curves Ei and E2 defined over 
the same finite field ¥q have the same number of points if and only 
if they are isogenous, i.e., there exists a nontrivial algebraic group 
homomorphism (p: Ei ^ E2 between them. If this (f) is efficiently 
computable and has a small kernel over Fg, we can solve DLOG on 
El, given a DLOG oracle for E2. 

Secondly, we recall the observation that DLOG on (Z/pZ)* has 
random self-reducibility: given any efficient algorithm A{g^) = x 
that solves DLOG on a polynomial fraction of inputs, one can solve 
any instance y = g^ hj an expected polynomial number of calls 
to A with random inputs of the form A{g^y). Thus, if DLOG on 
[Z/pZy is hard in a sense suitable for cryptography at all (e.g., has 
no polynomial on average attack), then all but a negligible fraction of 
instances of DLOG on (Z/pZ)* must necessarily be hard. This result 
is comforting since for cryptographic use we need the DLOG problem 
to be hard with overwhelming probability when we pick inputs at 
random. The same random self-reduction statement also holds true 
for DLOG on any abelian group, and in particular for DLOG on a fixed 
elliptic curve. We consider instead the following question: given a 
polynomial time algorithm to solve DLOG on some positive (or non- 
negligible) fraction of isogenous elliptic curves over Fg, can we solve 
DLOG for all curves in the same isogeny class in polynomial time? In 
this paper we show that the answer to this question is essentially yes, 
by proving (assuming GRH) the mixing properties of random walks 
of isogenies on elliptic curves. It follows that if DLOG is hard at all in 
an isogeny class, then DLOG is hard for all but a negligible fraction of 
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elliptic curves in that isogeny class. This result therefore justifies, in 
an average case sense, the cryptographic practice of selecting curves 
at random within an isogeny class. 

1.1 Summary of our results 

The conventional wisdom is that if two elliptic curves over the same 
finite field have the same order, then their discrete logarithm prob- 
lems are equally hard. Indeed, this philosophy is embodied in the 
way one picks curves in practice. However, such a widely relied upon 
assertion merits formal justification. Our work shows that this sim- 
plified belief is essentially true for all elliptic curves which are con- 
structible using present techniques, but with an important qualifica- 
tion which we shall now describe. 

Specifically, let SN,q denote the set of elliptic curves defined over 
a given finite field Fg, up to Fg-isomorphism, that have the same 
order N over Fg. We split SN,q into levels (as in Kohel [22]), where 
each level represents all elliptic curves having a particular endomor- 
phism ring over Fg. The curves in each level form the vertices of an 
isogeny graph jTUHHlESl, whose edges represent prime degree isoge- 
nies between curves of degree less than some specified bound m. 

Theorem 1.1. (Assuming GRH) There exists a polynomial p{x), 
independent of N and q, such that for m = p{logq) the isogeny 
graph Q on each level is an expander graph, in the sense that any 
random walk on Q will reach a subset of size h with probability at least 
2p- after polylog(g) steps (where the implicit polynomial is again 
independent of N and q). 

Corollary 1.2 (Assuming GRH) The DLOG problem on elliptic curves 
is random reducible in the following sense: given any algorithm A 
that solves DLOG on some fixed positive proportion of curves in fixed 
level, one can probabilistically solve DLOG on any given curve in that 
same level with polylog(g) expected queries to A with random inputs. 

The proofs are given at the end of Section 0] These results consti- 
tute the first formulation of a polynomial time random reducibility 
result for the elliptic curve DLOG problem which is general enough 
to apply to typical curves that one ordinarily encounters in practice. 
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An essential tool in our proof is the nearly Ramanujan property of 
Section El which we use to prove the expansion properties of our 
isogeny graphs. The expansion property in turn allows us to prove 
the rapid mixing of random walks given by compositions of small 
degree isogenics within a fixed level. Our method uses GRH to prove 
eigenvalue separation for these graphs, and provides a new technique 
for constructing expander graphs. 

The results stated above concern a fixed level. One might there- 
fore object that our work does not adequately address the issue of 
DLOG reduction in the case where two isogenous elliptic curves be- 
long to different levels. If an attack is balanced, i.e., successful on 
each level on a polynomial fraction of curves, then our results apply. 
However, if only unbalanced attacks exist, then a more general equiv- 
alence may be false for more fundamental reasons. Nevertheless, at 
present this omission is not of much practical importance. First of 
all, most random curves over Fg belong to sets SN,q consisting of only 
one level (see SectionlHl); for example, in FigurelH we find that 10 out 
of the 11 randomly generated curves appearing in international stan- 
dards documents have only one level. Second, if the endomorphism 
rings corresponding to two levels have conductors whose prime fac- 
torizations differ by quantities which are polynomially smooth, then 
one can use the algorithms of ^T1I2S1 to navigate to a common level 
in polynomial time, and then apply CoroUarv II . 21 within that level to 
conclude that DLOG is polynomial-time random reducible between 
the two levels. This situation always arises in practice, because no 
polynomial time algorithm is known which even produces a pair of 
curves lying on levels whose conductor difference is not polynomially 
smooth. It is an open problem if such an algorithm exists. 

Our use of random walks to reach large subsets of the isogeny 
graph is crucial, since constructing an isogeny between two specific 
curves^ is believed to be inherently hard, whereas constructing an 
isogeny from a fixed curve to a subset constituting a positive (or 
polynomial) fraction of the isogeny graph is proved in this paper 
to be easy. Kohel and Galbraith ^1] present exponential time 

^ If one uses polynomial size circuits (i.e., polynomial time algorithms with exponential 
time pre-processing) for reductions, then one can relate DLOG on two given curves. 
This claim follows using the smallness of diameter of our graphs and the smoothness 
of the degrees of isogenies involved. We omit the details. 
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Curve 


(maximal conductor gap in isogeny class) 


P(c^) = largest prime factor of 


NIST P-192 


1 


1 


NIST P-256 


3 


3 


IN io J- r-OO'i 






NIST P-521 


1 


1 


NIST K-163 


45641 ■ 82153 ■ 56498081 ■ P(c„ ) 


86110311 


NIST K-233 


5610641 ■ 85310626991 ■ P(c^ ) 


150532234816721999 


NIST K-283 


1697-162254089-P(c,) 


1779143207551652584836995286271 


NIST K-409 


21262439877311 ■ 22431439539154506863 ■ P(c„ ) 


57030553306655053533734286593 


NIST K-571 


3952463 -PCc^) 


9021184135396238924389891 (contd) 
9451926768145189936450898(contd) 
07769277009849103733654828039 


NIST B-163 


1 


1 


NIST B-233 


1 


1 


NIST B-283 


1 


1 


NIST B-409 


1 


1 


NIST B-571 


1 


1 


IPScc 3''''OG,F,i55 


1 


1 


IPSec 4"*OG, -F5,185 


1 


1 



Fig. 1. A table of curves recommended as international standards 
(iniEn]- Note that the value of c^r for each of the standards curves 
is small (at most 3), except for the curves in the NIST K (Koblitz 
curve) family. These phenomena are to be expected and are explained 
in Sectional Any curve with = 1 has the property that its isogeny 
class consists of only one level. It follows from the results of Sec- 
tion 11.11 that randomly generated elliptic curves with c^r = 1 (or, 
more generally, with smooth Cvr) will have discrete logarithm prob- 
lems of typical difficulty amongst all elliptic curves in their isogeny 
class. 



algorithms (and thus exponential time reductions) for navigating be- 
tween two nodes in the isogeny graph, some of which are based on 
random walk heuristics which we prove here rigorously. Subsequent 
papers on Weil descent attacks [T21E21 and elliptic curve trapdoor 
systems jl^l also use isogeny random walks in order to extend the 
GHS Weil descent attack [T^ to elliptic curves which are not them- 
selves directly vulnerable to the GHS attack. Our work does not 
imply any changes to the deductions of these papers, since they also 
rely on the above heuristic assumptions involving exponentially long 
random walks. In our case, we achieve polynomial time instead of 
exponential time reductions; this is possible since we keep one curve 
fixed, and random reducibility requires only that the other curve be 
randomly distributed. 
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2 Preliminaries 

Let El and E2 be elliptic curves defined over a finite field ¥q of char- 
acteristic p. An isogeny (p: Ei ^ E2 defined over is a non-constant 
rational map defined over which is also a group homomorphism 
from Ei{¥q) to -£^2(1^^) |12l §111.4]. The degree of an isogeny is its 
degree as a rational map. For any elliptic curve E: y"^ + aixy + a^y = 
+ a2x'^ + a4X + Oe defined over ¥g, the Frobenius endomorphism 
is the isogeny vr: E ^ E of degree q given by the equation 7i{x, y) = 
{x'^,y'^). It satisfies the equation 

7r^ — Trace(£')7r + q = 0, 

where Trace(i?) = q+l — j^E{¥q) is the trace of the Frobenius endo- 
morphism of E over Fg. The polynomial := X^ — Trace(i?)X+g 
is called the characteristic polynomial of E. 

An endomorphism of E is an isogeny E ^ E defined over the 
algebraic closure Fg of F,. The set of endomorphisms of E together 
with the zero map forms a ring under the operations of pointwise 
addition and composition; this ring is called the endomorphism ring 
of E and denoted End(£'). The ring End(£^) is isomorphic either 
to an order in a quaternion algebra or to an order in an imaginary 
quadratic field |12 V.3.1]; in the first case we say E is supersingular 
and in the second case we say E is ordinary. In the latter situation, 
the Frobenius endomorphism vr can be regarded as an algebraic in- 
teger which is a root of the characteristic polynomial. 

Two elhptic curves Ei and E2 defined over ¥g are said to be isoge- 
nous over F^ if there exists an isogeny (p: Ei ^ E2 defined over F^. A 
theorem of Tate states that two curves Ei and E2 are isogenous over 
¥q if and only if ^Ei(¥q) = ^E2(¥q) jl3 §3]. Since every isogeny has 
a dual isogeny III.6.1], the property of being isogenous over Fg 
is an equivalence relation on the finite set of F^-isomorphism classes 
of elliptic curves defined over F^. We define an isogeny class to be 
an equivalence class of elliptic curves, up to F^-isomorphism, under 
this equivalence relation; the set SN,q of Section lOI is thus equal to 
the isogeny class of elliptic curves over Fg having cardinality N. 

Curves in the same isogeny class are either all supersingular or all 
ordinary. We assume for the remainder of this paper that we are in 
the ordinary case, which is the more interesting case from the point 
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of view of cryptography in light of the MOV attack PU^. Theorem ll.il 
in the supersingular case was essentially known earlier by results of 
Pizer P7ll38j . and a proof has been included for completeness in 
Appendix |X| 

The following theorem describes the structure of elliptic curves 
within an isogeny class from the point of view of their endomorphism 
rings. 

Theorem 2.1. Let E and E' be ordinary elliptic curves defined 
over ¥q which are isogenous over ¥g. Let K denote the imaginary 
quadratic field containing End(i?), and write Ok for the maximal 
order (i.e., ring of integers) of K. 

1. The order End(i?) satisfies the property Z[7r] C End(£') C Ok- 

2. The or(/er End(E') also satisfies End{E') C K and Z[7c] C End(E') C 
Ok. 

3. The following are equivalent: 
(a) End(E) = End(E'). 

(h ) There exist two isogenics : E ^ E' and ip: E E' of rela- 
tively prime degree, both defined over ¥q. 

(c) [Ok : End(E)] = [Ok : End(^')]- 

(d) [End(E) : Z[n]] = [End(E') : Z[n]]. 

4. Let (p: E —>■ E' be an isogeny from E to E' of prime degree i, de- 
fined over ¥q. Then either End{E) contains End{E') or End 
contains Eiad{E), and the index of the smaller in the larger di- 
vides i. 

5. Suppose i is a prime that divides one of [Ok '■ End(-E')] and 
[Ok '■ End(£")], but not the other. Then every isogeny 0: E E' 
defined over ¥g has degree equal to a multiple of i. 

Proof 23, §4.2]. 

For any order O C Ok, the conductor of O is defined to be 
the integer [Ok : O]. The field K is called the CM field of E. We 
write Ce for the conductor of End(-E) and for the conductor of 
Z[7r]. Note that this is not the same thing as the arithmetic con- 
ductor of an elliptic curve |12l §C.16], nor is it related to the con- 
ductance of an expander graph It follows from jH (7.2) and 
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(7.3)] that End(i?) = Z + ceOk and D = c\dK, where D (respec- 
tively, (Ik) is the discriminant of the order End(i?) (respectively. 
Ok)- Furthermore, the characteristic polynomial p(X) has discrim- 
inant = disc(p(X)) = Trace(i?)^ — 4g = disc(Z[7r]) = c^cLk-, with 
c^ = ce- [End(E) : Zfvr]]. 

Following and ^T], we say that an isogeny (p: E ^ E' of 
prime degree £ defined over ¥q is "down" if [End(i?) : End{E')] = 
i, "up" if [End(E') : End(E)] = i, and "horizontal" if End(E) = 
End(i?). The following theorem classifies the number of degree i 
isogenies of each type in terms of the Legendre symbol (y) . 

Theorem 2.2. Let E be an ordinary elliptic curve over ¥q, with 
endomorphism ring End{E) of discriminant D. Let i be a prime 
different from the characteristic of¥q. 

— Assume i \ ce- Then there are exactly 1+ (y) horizontal isogenies 
(p: E E' of degree i. 

• If i \ Ctt, there are no other isogenies E E' of degree i over 

• If i \ c,r; there are £ — (y) down isogenies of degree i. 

— Assume I \ ce- Then there is one up isogeny E ^ E' of degree I. 

• If i \ —, there are no other isogenies E ^ E' of degree £ over 
¥ ^ 

11 g. 

• If i \ f^, there are £ down isogenies of degree £. 

Proof §2.1] or ^ §11.5]. 

It follows that the maximal conductor difference between levels 
in an isogeny class is achieved between a curve at the top level (with 
End(ii^) = Ok) and a curve at the bottom level (with End(£') = 
Z[7r]). 

2.1 Isogeny Graphs 

We define two curves Ei and E2 in an isogeny class SN,q to have the 
same level if End(-Ei) = End(-E'2)- An isogeny graph is a graph whose 
nodes consist of all elements in S^^g belonging to a fixed level. Note 
that a horizontal isogeny always goes between two curves of the same 
level; likewise, an up isogeny enlarges the size of the endomorphism 
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ring and a down isogeny reduces the size. Since there are fewer elliptic 
curves at higher levels than at lower levels, the collection of isogeny 
graphs under the level interpretation visually resembles a "pyramid" 
or a "volcano" [10], with up isogenics ascending the structure and 
down isogenics descending. 

As in [13 Prop. 2.3], we define two isogenics 4>: Ei ^ E2 and 
(j)' : El ^ E2 to be equivalent if there exists an automorphism a G 
Aut(£^2) (i-e., an invertible endomorphism) such that 0' = a0. The 
edges of the graph consist of equivalence classes of isogenics over Fg 
between elliptic curve representatives of nodes in the graph, which 
have prime degree less than the bound (logg)^^*^ for some fixed con- 
stant S > 0. The degree bound must be small enough to permit the 
isogenics to be computed, but large enough to allow the graph to be 
connected and to have the rapid mixing properties that we want. We 
will show in Section |3 that there exists a constant 6 > for which 
a bound of (logg)^"'"'' satisfies all the requirements, provided that we 
restrict the isogenics to a single level. 

Accordingly, fix a level of the isogeny class, and let End(£') = O 
be the common endomorphism ring of all of the elliptic curves in this 
level. Denote by Q the regular graph whose vertices are elements 
of Sj^f^q with endomorphism ring O, and whose edges are equiva- 
lence classes of horizontal isogenics defined over Fg of prime degree 
< (logg)^^'^. By standard facts from the theory of complex multi- 
plication lU §10], each invertible ideal a C O produces an elliptic 
curve C/a defined over some number field L C C (called the ring 
class field of O) ^ §11]. The curve C/a has complex multiplication 
by O, and two different ideals yield isomorphic curves if and only if 
they belong to the same ideal class. Likewise, each invertible ideal 
b C O defines an isogeny C/a ^ C/ab~^, and the degree of this 
isogeny is the norm N{b) of the ideal b. Moreover, for any prime 
ideal *p in L lying over p, the reductions mod ^ of the above elliptic 
curves and isogenics are defined over F^, and every elliptic curve and 
every horizontal isogeny in Q arises in this way (see pTj §3] for the 
p > 3 case, and jT2] for the small characteristic case). Therefore, 
the isogeny graph Q is isomorphic to the corresponding graph Ti 
whose nodes are elliptic curves C/a with complex multiplication by 
O, and whose edges are complex analytic isogenics represented by 
ideals b <Z O and subject to the same degree bound as before. This 
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isomorphism preserves the degrees of isogenies, in the sense that the 
degree of any isogeny in Q is equal to the norm of its corresponding 
ideal b in H. 

The graph Ti. has an alternate description as a Cayley graph on 
the ideal class group C\{0) of O. Indeed, each node of TC is an ideal 
class of O, and two ideal classes [oi] and [02] are connected by an 
edge if and only if there exists a prime ideal b of norm < (logg)^^^ 
such that [oib] = [02]. Therefore, the graph H (and hence the graph 
Q) is isomorphic to the Cayley graph of the group C1(0) with respect 
to the generators [b] e Cl{0), as b ranges over all prime ideals of O 
of norm < (logg)^"'"''. 

Remark 2.1. The isogeny graph Q consists of objects defined over the 
finite field Fg, whereas the objects in the graph Ti are defined over the 
number field L. One passes from TitoQhy taking reductions mod ^, 
and from ^ to 7^ by using Deuring's Lifting Theorem |SlllHI24j . There 
is no known polynomial time or even subexponential time algorithm 
for computing the isomorphism between Q and Ti §3]. For our 
purposes, such an explicit algorithm is not necessary, since we only 
use the complex analytic theory to prove abstract graph-theoretic 
properties of Q. 

Remark 2.2. The isogeny graph Q is typically a symmetric graph, 
since each isogeny has a unique dual isogeny (p: E2 ^ Ei of the 
same degree as in the opposite direction §111.6]. (From the 
viewpoint of 7-^, an isogeny represented by an ideal b C O has its 
dual isogeny represented simply by the complex conjugate b.) How- 
ever, the definition of equivalence of isogenies from given in 12.11 
contains a subtle asymmetry which can sometimes render the graph 
Q asymmetric in the supersingular case (Appendix^. Namely, if 
Aut(ii^i) is not equal to Aut(£'2), then two isogenies Ei E2 can 
sometimes be equivalent even when their dual isogenies are not. 
For ordinary elliptic curves within a common level, the equation 
End(£^i) = End(i?2) automatically implies Aut(£'i) = Aut(£'2), so 
the graph Q is always symmetric in this case. Hence, we may regard 
Q as undirected and apply known results about undirected expander 
graphs (as in the following section) to Q. 
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3 Expander Graphs 

Let G = (V, E) be a finite graph on h vertices V with undirected 
edges £. Suppose G is a regular graph of degree k, i.e., exactly k edges 
meet at each vertex. Given a labeling of the vertices V = {f i, . . . ,Vh}, 
the adjacency matrix of G is the symmetric hxh matrix A whose ij- 
th entry Aij = 1 if an edge exists between Vi and Vj, and otherwise. 

It is convenient to identify functions on V with vectors in M.^ via 
this labeling, and therefore also think of A as a self-adjoint opera- 
tor on L^(V). All of the eigenvalues of A satisfy the bound |A| < k. 
Constant vectors are eigenf unctions of A with eigenvalue k, which for 
obvious reasons is called the trivial eigenvalue A|-j.jy. A family of such 
graphs G with /i ^ oo is said to be a sequence of expander graphs if 
all other eigenvalues of their adjacency matrices are bounded away 
from A^^jy = by a fixed amount.^ In particular, no other eigen- 
value is equal to k; this implies the graph is connected. A Ramanujan 
graph j2S] is a special type of expander which has |A| < 2\/k — 1 for 
any nontrivial eigenvalue which is not equal to — fc (this last possibil- 
ity happens if and only if the graph is bipartite). The supersingular 
isogeny graphs in Appendix El are sometimes Ramanujan, while the 
ordinary isogeny graphs in Section ITTl do not qualify, partly because 
their degree is not bounded. Nevertheless, they still share the most 
important properties of expanders as far as our applications are con- 
cerned. In particular their degree k grows slowly (as a polynomial in 
log |V|), and they share a qualitatively similar eigenvalue separation: 
instead the nontrivial eigenvalues A can be arranged to be 0{k^^'^~^'^) 
for any desired value of £ > 0. Since our goal is to establish a poly- 
nomial time reduction, this enlarged degree bound is natural, and in 
fact necessary for obtaining expanders from abelian Cayley graphs 
pp. Obtaining any nontrivial exponent (3 < 1 satisfying A = 0{k^) is 
a key challenge for many applications, and accordingly we shall focus 
on a type of graphs we call "nearly Ramanujan" graphs: families of 
graphs whose nontrivial eigenvalues A satisfy that bound. 

A fundamental use of expanders is to prove the rapid mixing of 
the random walk on V along the edges S. The following rapid mixing 

^ Expansion is usually phrased in terms of the number of neighbors of subsets of G, but 
the spectral condition here is equivalent for fc-regular graphs and also more useful 
for our purposes. 
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result is standard but we present it below for convenience. For more 
information, see [Sl I^HO] . 

Proposition 3.1 Let G be a regular graph of degree k on h ver- 
tices. Suppose that the eigenvalue A of any nonconstant eigenvector 
satisfies the bound |A| < c for some c < k. Let S be any subset of 
the vertices of G, and x be any vertex in G. Then a random walk 
of any length at least ^"^i^Jl^/l — starting from x will land in S with 
probability at least ^ = Jj^. 

Proof. There are k^ random walks of length r starting from x. One 
would expect in a truly random situation that roughly ^-jj-k^ of these 
land in S. The lemma asserts that for r > ^"s-^^/l-^l ^ at least half that 

— log fe/c 

number of walks in fact do. Denoting the characteristic functions of 
S and {x} as xs and X{x}, respectively, we count that 

# {walks of length r starting at x and landing in 5} = {xs , A^X{x} ) 

(3.1) 

where (■, ■) denotes the inner product of functions in L^{y). We esti- 
mate this as follows. Write the orthogonal decompositions of xs and 

X{x} as 

IS"! 1 

Xs = j^l + u and X{x} = j^l + w , (3.2) 

where 1 is the constant vector and {u, 1) = {w, 1) = 0. Then 1)3.111 
equals the expected value of ^fc*^, plus the additional term {u, A''w), 
which is bounded by Because w -L 1 and the symmetric 

matrix has spectrum bounded by c*" on the span of such vectors, 

\\u\\\\A^w\\ < c'\\u\\\\w\\ < c^\\xs\\\\X{x}\\ = c^^r/'. (3.3) 

For our values of r this is at most half of ^fc'^, so indeed at least 
I'^fc'" of the paths terminate in 5* as was required. 

In our application the quantities fc, and will all be bounded 
by polynomials in \og{h). Under these hypotheses, the probability is 
at least 1/2 that some polylog(/;.) trials of random walks of polylog(/i) 
length starting from x will reach S at least once. This mixing es- 
timate is the source of our polynomial time random reducibility 
(Corollary Ol). 
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4 Spectral Properties of the Isogeny Graph 

4.1 Navigating the Isogeny Graph 

Let Q be as in Section 12.11 The isogeny graph Q has exponentially 
many nodes and thus is too large to be stored. However, given a curve 
E and a prime i, it is possible to efficiently compute the curves which 
are connected to E by an isogeny of degree i. These curves E' have 
j-invariants which can be found by solving the modular polynomial 
relation (Pi{j{E), j{E')) = 0; the cost of this step is 0{i^) field oper- 
ations 11.6]. Given the j-invariants, the isogenics themselves can 
then be obtained using the algorithms of [TUI (or 123123 when the 
characteristic of the field is small). In this way, it is possible to nav- 
igate the isogeny graph locally without computing the entire graph. 
We shall see that it suffices to have the degree of the isogenics in the 
graph be bounded by (logg)^"*"^ to assure the Ramanujan properties 
required for Q to be an expander. 

4.2 ^-Functions and Graph Eigenvalues 

The graph Ti. (and therefore also the isomorphic graph Q) has one 
node for each ideal class of O. Therefore, the total number of nodes 
in the graph Q is the ideal class number of the order O, and the ver- 
tices V can be identified with ideal class representatives {ai, . . . , ah}- 
Using the isomorphism between Q and Ti, we see that the generating 
function ^Ma. Q,.(n)g" for degree n isogenics between the vertices 
tti and aj of Q is given by 

oo ^ 

5^M„,,.^,(n)g" := 1 , (4.I) 

where e is the number of units in O (which always equals 2 for 
disc((!?) > 4). The sum on the righthand side depends only on the 
ideal class of the fractional ideal a~^aj; by viewing the latter as a 
lattice in C, we see that N{z)/N{a~^aj) is a quadratic form of dis- 
criminant D where D := disc((9) [H p. 142]. That means this sum 
is a 6'-series, accordingly denoted as -1 (q). It is a holomorphic 
modular form of weight 1 for the congruence subgroup /o(|D|) of 
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SL{2, Z), transforming according to the character (— ) (see The- 
orem 10.9]). 

Before discussing exactly which degrees of isogenics to admit into 
our isogeny graph Q, let us first make some remarks about the sim- 
pler graph on V = {ai, . . . , ah} whose edges represent isogenics of 
degree exactly equal to n. Its adjacency matrix is of course the 
h X h matrix M(n) = [Mai,aj{n')] j^^^y defined by series coef- 
ficients in (14. ip . It can be naturally viewed as an operator which 
acts on functions on V = {ai, . . . , a/j}, by identifying them with 
/t-vectors according to this labeling. We will now simultaneously di- 
agonalize all M{n), or what amounts to the same, diagonalize the 
matrix Ag = Y2n>i M{n)q"' for any value of g < 1 (where the sum 
converges absolutely). The primary reason this is possible is that for 
each fixed n this graph is an abelian Cayley graph on the ideal class 
group C\{0), with generating set equal to those classes which rep- 
resent an n-isogeny. The eigenf unctions of the adjacency matrix of 
an abelian Cayley graph are always given by characters of the group 
(viewed as functions on the graph), and their respective eigenvalues 
are sums of these characters over the generating set. This can be 
seen directly in our circumstance as follows. The ij-th entry of Ag 
is ^d^-i^^{q), which we recall depends only on the ideal class of the 
fractional ideal a~^aj. If x is any character of C\{0), viewed as the 
/i- vector whose i-th entry is xl^^i)? then the i-th entry of the vector 
AqX may be evaluated through matrix multiplication as 



{Agx){ai) = ^ e^-i^^{q)x{aj) = J2 xi^j) Oa,{q)\ x{ 

(4.2) 

where in the last equality we have reindexed aj ^ ai aj using the 
group structure of C\{0). Therefore x is in fact an eigenvector of 
the matrix cAg, with eigenvalue equal to the sum of ^-functions 
enclosed in parentheses, known as a Hecke 6 -function (see [121 §12]). 
These, which we shall denote 0^{q), form a more natural basis of 
modular forms than the ideal class ^-functions 6^^ because they are 
in fact Hecke eigenforms. Using ()4.1|) . the L-functions of these Hecke 
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characters can be written as 

oo 

L{s,x) = L{s,e^) = Yl x(a)(iVa)-^ = J^a.^n" 

integral ideals aGK n=l 

where a„(x) = ^ x{a) 

integral ideals aGK 
Na=n 

(4.3) 

is in fact simply the eigenvalue of e M{n) for the eigenvector formed 
from the character x as above, which can be seen by isolating the 
coefficient of in the sum on the righthand side of ()4.2|) . 



4.3 Eigenvalue Separation under the Generalized 
Riemann Hypothesis 

Our isogeny graph is a superposition of the previous graphs M(n), 
where n is a prime bounded by a parameter m (which we recall 
is (logg)^"'"'^ for some fixed 6 > 0). This corresponds to a graph 
on the elliptic curves represented by ideal classes in an order O of 
K = Q(v^), whose edges represent isogenics of prime degree < m. 
The graphs with adjacency matrices {M{p) \ p < m} above share 
common eigenf unctions (the characters x of Cl((9)), and so their 
eigenvalues are 

Ax = = ;E E Xia). (4.4) 

p<m p<m integral ideals aC K 

Na = p 

When X is the trivial character, Atriv equals the degree of the reg- 
ular graph Q. Since roughly half of rational primes p split in K, 
and those which do split into two ideals of norm p, Atriv is roughly 
^^^^ ~ — by the prime number theorem. This eigenvalue is al- 

e e log m •' ^ ^3 

ways the largest in absolute value, as can be deduced from ()4.4p . 
because \x{<^)\ always equals 1 when x is the trivial character. For 
the polynomial mixing of the random walk in Theorem 11.11 we will 
require a separation between the trivial and nontrivial eigenvalues 
of size l/polylog(g). This would be the case, for example, if for each 
nontrivial character x there merely exists one ideal a of prime norm 
< m with Rex(a) < 1 lo ( v "^^^^ analogous to the problem 
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of finding a small prime nonresidue modulo, say, a large prime Q, 
where one merely needs to find any cancellation at all in the charac- 
ter sum J2p<ni (q) • However, the latter requires a strong assumption 
from analytic number theory, such as the Generalized Riemann Hy- 
pothesis (GRH). In the next section we will accordingly derive such 
bounds for A^^-, under the assumption of GRH. As a consequence of 
the more general Lemma f5. 31 we will show the following. 

Lemma 4.1 Let D < and let O be the quadratic order of discrim- 
inant D. Ifx is a nontrivial ideal class character of O, then the Gen- 
eralized Riemann Hypothesis for L{s, x) implies that the sum ^■4\ ) 
is bounded by 0(m^/^ log |mD|) with an absolute implied constant. 

Proof (of Theorem \1.1]} . There are only finitely many levels for q 
less than any given bound, so it suffices to prove the theorem for 
q large and p{x) = x^"*"*^, where 5 > is fixed. The eigenvalues of 
the adjacency matrix for a given level are given by ()4.4|) . Recall that 
\D\ < 4g and X^^yw ~ eiogm ' ^i^^ choice of m = j9(logg), the 
bound for the nontrivial eigenvalues in Lemma HH] is A^^ = 0{X^j.^^) 
for any P > ^ -\- That means indeed our isogeny graphs are 
expanders for q large; the random walk assertion follows from this 
bound and Proposition 13.11 

Proof (of Corollaru \l.^} . The Theorem shows that a random walk 
from any fixed curve E probabilistically reaches the proportion where 
the algorithm A succeeds, in at most polylog(g) steps. Since each 
step is a low degree isogeny, their composition can be computed in 
polylog(g) steps. Even though the degree of this isogeny might be 
large, the degrees of each step are small. This provides the random 
polynomial time reduction of DLOG along successive curves in the 
random walk, and hence from E to a curve for which the algorithm 
A succeeds. 

5 The Prime Number Theorem for Modular 
Form Z- functions 

In this section we prove Lemma 14.11 assuming the Generalized Rie- 
mann Hypothesis (GRH) for the L-functions ()4.3p . Our argument 
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is more general, and in fact gives estimates for sums of the form 
Sp<m '^P' where Qp are the prime coefficients of any L-function. This 
can be thought of as an analog of the Prime Number Theorem be- 
cause for the simplest L-function, ({s), = 1 and this sum is in fact 
exactly 7r(m). As a compromise between readability and generality, 
we will restrict the presentation here to the case of modular form 
L-functions (including ()4.3|) ). Background references for this section 
include [T^I^ IH^: for information about more general L-functions 
see also 

We shall now consider a classical holomorphic modular form /, 
with Fourier expansion f{z) = J2'^=o CnC^'^*'^^. We will assume that 
/ is a Hecke eigenform, since this condition is met in the situation of 
Lemma [4. II (see the comments between (j4.2|) and (j4.3|) ). It is natural 
to study the renormalized coefficients a„ = n~'^'^^^^/^c„, where k > 1 
is the weight of / (in Section l¥!^ fc = 1, so a„ = c„). The L-function of 
such a modular form can be written as the Dirichlet series L(s, /) = 
Y,n=i «nn"* = Hp (l-«pP~'')~"^(l-/5pP~*)~S the last equality using 
the fact that / is a Hecke eigenform. The L-function L(s, /) is entire 
when / is a cusp form (e.g. Oq = 0). The Ramanujan conjecture (in 
this case a theorem of and [?]) asserts that < 1. 

Lemma 14.11 is concerned with estimates for the sums 



As with the prime number theorem, it is more convenient to instead 
analyze the weighted sum 



over prime powers, where the coefficients 6„ are those appearing in 




(5.1) 




(5.2) 



the Dirichlet series for — -^(s): 




oo 



J2 ^(^) 



n 



s 



^ bpk log(p) p 



— ks 



n = l 



p,k 




a'p + P^- 
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Lemma 5.1 For a holomorphic modular form f one has 
ip{m, f) = ^^Oplogp + 0(m^/^). 

p<m 

Proof. The error term represents the contribution of proper prime 
powers. Since \bpk \ < 2, it is bounded by twice 

El \ ^ , X ^ logm i/2\i 
logp = > logp < > logp- < Trim' jlogm, 

z-^ log p 

■p^ <m p<m}l'^ p<m^/^ 

k>2 2<k<^-2^ 

— — logp 

(5.3) 

which is 0(m^/^) by the Prime Number Theorem. 

Lemma 5.2 (Iwaniec \2IA p. 114]) Assume that f is a holomorphic 
modular cusp form of levels N and that L{s, f) satisfies GRH. Then 
ipijn., f) = 0(m^/^log(m) log(mA^)). 

We deduce that S"(m, /) := J2p<m'^p^'^SP = 0{m^/'^ log(m) log(mA^)). 
Finally we shall estimate the sums S'(m, /) from ()5.H) by removing 
the log(m) using a standard partial summation argument. 

Lemma 5.3 Suppose that f is a holomorphic modular cusp form of 
level N andL{s, f) satisfies GRH. Then S{m, f) = 0{m^^'^\og{mN)). 

Proof. First define cip to be a^, if p is prime, and otherwise. Then 
y^ap = V [oplogp] = V[a„logn]--^. 

p<m p<m n<m 

By partial summation over 2 < n < m, we then find 

S'(m,/) 



p<.m n <.m 

•C y {n^l'^\og{n)\og{nN)) ^ 



,,J(logn)-) 

■C n^/Mog(n)log(nA^)— TT + m^/^ log(mA^) 
^-^ nnognV 



logm 

+ m^^"^ log{mN) 



so in fact S{m, f) = J2p<m '^p = 0{m^^'^ \og{mN)). 

^ Actually in I20| A'' equals the conductor of the L-function, which in general may be 
smaller than the level. The lemma is of course nevertheless valid. 
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All the implied constants in these 3 lemmas are absolute. Some 
useful estimates for them may be found in [2]. 

5.1 Subexponential Reductions via Lindelof Hypothesis 

In the previous lemma we have assumed GRH. It seems very difficult 
to get a corresponding unconditional bound for S{m,f). However, 
a slightly weaker statement can be proven by assuming only the 
Lindelof hypothesis (which is a consequence of GRH). Namely, one 
has that j^uKm = 0,{m^/'^+^N'), for any e > (dHl (5.61)]). 
The fact that this last sum is over all n < m, not just primes, is not 
of crucial importance for our application. However, the significant 
difference here is that the dependence on is not polynomial in 
logA^, but merely subexponential. This observation can be used to 
weaken the hypothesis in Theorem 11.11 and Corollarv 11.21 from GRH 
to the Lindelof hypothesis, at the expense of replacing "polynomial" 
by "subexponential." 

6 Distribution of c^r 

Theorem II. II and Corollarv 11.21 are statements about individual lev- 
els. As we mentioned in Section II. H our random reducibility result 
extends between two levels as long as the levels satisfy the require- 
ment that their conductors differ by polynomially smooth amounts. 
In this section we explore this extension in more detail, and explain 
why the above requirement is typically satisfied. 

It was mentioned after Theorem 12.21 that the largest possible 
conductor difference is Cn, which is the largest square factor of = 
Trace (i?)^ — 4g. In principle this factor could be as large as 2y/q, 
though statistically speaking most integers (a proportion of ~ .61) 
are square- free, explaining why c^^ is very often 1 or at least fairly 
small IH]. This means, for example, that most randomly selected 
elliptic curves have an isogeny class consisting of only one level. 

When an isogeny class consists of multiple levels, we need to be 
able to construct vertical isogenics between levels in order to con- 
clude that DLOG instances between the levels are randomly reducible 
to each other. The fastest known algorithm for constructing vertical 
isogenics between two levels, due to Kohel has runtime 0(^^), 
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where £ is the largest prime dividing the conductor of one of the 
levels, but not the other. Any two levels which can be efficiently 
bridged via Kohel's algorithm can be considered as one unit for the 
purposes of random reducibility. Accordingly, polynomial time ran- 
dom reducibility holds within an isogeny class if c,r for that isogeny 
class is polynomially smooth. 

With this in mind, we will now determine a heuristic estimate 
for the expected size of the largest prime factor P(c^) of c^r, i.e., 
the largest prime which divides d^^ to order at least 2. The trace 
t = Trace(-E), when sampled over random elliptic curves, is thought 
to have a fairly uniform distribution over most of the Hasse interval. 
This serves to predict the useful heuristic that —d.„ = — t^ is 
typically of size q (see for example [23 EI])- Assuming that, the 
probability that P{ct,) exceeds /? can be loosely estimated as 0(1//?). 
This is because roughly a fraction of p = 11^/3 "~ P '^) integers 
of size q have no repeated prime factor p > [3. It is easy to see 
that log(p) = 0(^„>^n-2) = 0(l//3), so that 1 - p = 0(l//5) as 
suggested. 

It follows that a randomly selected elliptic curve is extremely 
likely to have a small enough value of P{ct^) to allow for random 
reducibility throughout its entire isogeny class. This explains why 
in Figure H all of the randomly generated curves have P{ct^) = 1, 
except for one curve which has P(cvr) = 3. 

Finally, let us consider the situation where a non-random curve 
is deliberately selected so as to have a large value of c^. Currently 
the only known methods for constructing such curves is to use com- 
plex multiplication methods [3 Ch. VIII] to construct curves with a 
predetermined number of points chosen to ensure that c^r is almost 
as large as ^/d^. Some convenient examples of such curves are the 
Koblitz curves listed in the NIST FIPS 186-2 document [HE], which 
we have also tabulated in Figure H Since these curves all have com- 
plex multiplication by the field K = Q(v^— 7), the discriminants of 
these curves are of the form rf^ = — 7c^. If we assume that behaves 
as a random integer of size y/d^, which is roughly ^/q, then the dis- 
tribution of P(c^) is governed by the usual smoothness bounds for 
large integers and hence is typically too large to permit efficient 
application of Kohel's algorithm for navigating between levels. Thus 
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we cannot prove random reducibility from a theoretical standpoint 
for all of the elliptic curves within the isogeny class Sjy^g of such a spe- 
cially constructed curve. However, in practice only a small subset of 
the elliptic curves in SN,q are efficiently constructible using the com- 
plex multiplication method (or any other presently known method), 
and this subset coincides exactly with the subcoUection of levels in 
S]\f^g which are accessible from the top level (where End(£') = Ok) 
using Kohel's algorithm. Pending future developments, it therefore 
remains true that all of the special curves that we can construct 
within an isogeny class have equivalent DLOG problems in the ran- 
dom reducible sense. 
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A Supersingular Case 

In this appendix we discuss the isogeny graphs for supersingular el- 
liptic curves and prove Theorem 11.11 in this setting. The isogeny 
graphs were first considered by Mestre [^2], and were shown by 
Pizer jSZlEHl to have the Ramanujan property. Curiously, the actual 
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graphs were first described by Iliara fH] in 1965, but not noticed to 
be examples of expander graphs until much later. We have decided 
to give an account here for completeness, mainly following Pizer's ar- 
guments. The isogeny graphs we will present here differ from those 
in the ordinary case in that they are directed. This will cause no 
serious practical consequences, because one can arrange that only 
a bounded number of edges in these graphs will be unaccompanied 
by a reverse edge. Also, the implication about rapid mixing used for 
Theorem 11.11 carries over as well in the directed setting with almost 
no modification. It is instructive to compare the proofs for the ordi- 
nary and supersingular cases, in order to see how GRH plays a role 
analogous to the Ramanujan conjectures. 

Every Fg-isomorphism class of supersingular elliptic curves in 
characteristic p is defined over either Fp or Fp2 [321 , so it suffices 
to fix ¥q = ¥p2 as the field of definition for this discussion. Thus, in 
contrast to ordinary curves, there is a finite bound g on the number 
of isomorphism classes that can belong to any given isogeny class 
(this bound is in fact the genus of the modular curve Xq{p), which is 
roughly ^jj-). It turns out that all isomorphism classes of supersin- 
gular curves defined over Fp2 belong to the same isogeny class 
Because the number of supersingular curves up to isomorphism is so 
much smaller than the number of ordinary curves up to isomorphism, 
correspondingly fewer of the edges need to be included in order to 
form a Ramanujan graph. For a fixed prime value of i ^ p, we define 
the vertices of the supersingular isogeny graph Q to consist of these 
g isomorphism classes, with directed edges indexed by equivalence 
classes of degree-^ isogenics as defined below. In fact, we will prove 
that ^ is a directed k = i + 1-regular graph satisfying the Ramanu- 
jan bound of |A| < 2v^ = 2\^k — 1 for the nontrivial eigenvalues of 
its adjacency matrix. The degree i in particular may be taken to be 
as small as 2 or 3. 

For the definition of the equivalence classes of isogenics — as 
well as later for the proofs — we now need to recall the structure 
of the endomorphism rings of supersingular elliptic curves. In con- 
trast to the ordinary setting (Section |2]), the endomorphism ring 
End(£') is a maximal order in the quaternion algebra R = Qp,oo 
ramified at p and oo. Moreover, isomorphism classes of supersingu- 
lar curves Ei isogenous to E are in 1-1 correspondence with the left 
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ideal classes := llom{Ei, E) of R. As in Section ITTl call two iso- 
genies 0i, 02 : -Ej — >■ Ej equivalent if there exists an automorphism a 
of Ej such that 02 = ^^i- Under this relation, the set of equivalence 
classes of isogenies from Ei to Ej is equal to If^Ii modulo the units 
of Ij. This correspondence is degree preserving, in the sense that the 
degree of an isogeny equals the reduced norm of the corresponding 
element in Ij^h-, normalized by the norm of Ij^h itself. This is the 
notion of equivalence class of isogenies referred to in the definition of 
Q in the previous paragraph. Thus, for any integer n, the generating 
function for the number Mij{n) of equivalence classes of degree n 
isogenies from Ei to Ej (i.e., the number of edges between vertices 
representing elliptic curves Ei and Ej) is given by 

oo 

J]M.,(n)g" := ^ E g^^^^^^^^^^^^ (A.l) 

where Cj is the number of units in Ij (equivalently, the number of 
automorphisms of Ej). One knows that Cj < 6, and in fact Cj = 2 
except for at most two values of j - see the further remarks at the 
end of this appendix. Proofs for the statements in this paragraph 
can be found in [131 l38j. 

The 6'-series on the righthand side of ()A.1|) is a weight 2 modular 
form for the congruence subgroup EqI^p), and the matrices 

/Mn(n)-- - Mi,(n)\ 
Bin):=l : ••. : 

\M,iH-- - Mggin)J 

(called Brandt matrices) are simultaneously both the n-th Fourier 
coefficients of various modular forms, as well the adjacency matrices 
for the graph Q. A fundamental property of the Brandt matrices 
B{n) is that they represent the action of the n^^ Hecke operator 
T(n) on a certain basis of modular forms of weight 2 for FqIp) (see 
|37j). Thus the eigenvalues of B{n) are given by the n*^ coefficients 
of the weight-2 Hecke eigenforms for Fq (p) . These eigenforms include 
a single Eisenstein series, with the rest being cusp forms. Now we 
suppose that n = iis prime (mainly in order to simplify the following 
statements). The n^^ Hecke eigenvalue of the Eisenstein series is n+1, 



25 



Jao, Miller, and Venkatesan 



Difficulty of Discrete Log 



while those of the cusp forms are bounded in absolute value by 2^/n 
according to the Ramanujan conjectures (in this theorem of 

Eichler Pj and Igusa |IZI). Thus the adjacency matrix of Q has trivial 
eigenvalue equal to ^+1 (the degree k), and its nontrivial eigenvalues 
indeed satisfy the Ramanujan bound |A| < 2\/k — 1. 

Finally, we conclude with some comments about the potential 
asymmetry of the matrix B{n). This is due to the asymmetry in the 
definition of equivalence classes of isogenics. Indeed, if Aut(i?i) and 
Aut(£'2) are different, then two isogenics Ei — * E2 can sometimes be 
equivalent even when their dual isogenics are not equivalent. This 
problem arises only if one of the curves Ei has complex multiplication 
by either or e^'^*/^, since otherwise the only possible automor- 
phisms of Ei are the scalar multiplication maps ±1 42, §111.10]. In 
the supersingular setting, one can avoid curves with such unusually 
rich automorphism groups by choosing a characteristic p which splits 



in both and Zfe^^*/^]^ j^q^ ^2 (see (371 Prop. 4.6]). 



In the case of ordinary curves, however, the quadratic orders Z[-\/— 1] 

and Z[e^'^*/'^] both have class number 1, which then renders the issue 
moot because the isogeny graphs corresponding to these levels each 
have only one node. 
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